This seems to make clear what several other commenters have been pointing to: this isn’t you relating absolute facts of law in the way you've been claiming. It’s you relating your personal ethical evaluation and your opinion about how the laws should be interpreted and followed.
That, and 280 or so company reviews, conversations with compliance officers, CISOs, auditors, pentesters, lawyers and other people in the M&A space about how those companies deal with security issues, reports and what constitutes a potential breach and what does not.
As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.
And if I don’t see fines against Lovable and they don’t report this as a breach, it would seem to suggest that your stance across this post isn’t the degree of absolute fact you’ve presented it as?
As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.